Quantum Risk And Bitcoin: Preparing For A Post-Cryptographic World

Quantum computers attack Bitcoin by breaking the digital signature cryptography that authorizes transactions. Normally, a private key generates a signature that proves ownership when spending Bitcoin. A sufficiently powerful quantum computer can generate valid signatures using only the public key—no private key required. This means an attacker could authorize transactions on behalf of legitimate owners without their consent.

The threat unfolds in two stages. «Slow clock» quantum computers—likely neutral atom or trapped ion machines—could take weeks or months to crack cryptography, targeting static addresses with permanently exposed public keys. «Fast clock» systems—potentially superconducting or photonic—could operate in under 10 minutes, attacking transactions while they sit in the mempool waiting for confirmation. Once fast-clock capability arrives, on-chain migration to quantum-safe schemes becomes impossible, as any migration transaction itself becomes vulnerable mid-flight.

Public key exposure happens in specific circumstances. Addresses that have sent transactions expose their public keys on-chain for network verification. Additionally, infrastructure like Lightning Network nodes, exchange cold wallets, and cross-chain bridges often use static multisig addresses that cannot avoid repeated public key exposure. This architectural reality means approximately one-third of all Bitcoin sits in vulnerable addresses today.

Post-quantum signature schemes impose severe performance penalties that make developers hesitant to commit. Hash-based signatures can reduce Bitcoin's throughput from 7 transactions per second to as low as 0.3 TPS—a 95% degradation. Even the more efficient SPHINCS+ scheme would drop capacity to 4 TPS. These signatures balloon from under 100 bytes to several kilobytes or tens of kilobytes, drastically limiting how many transactions fit in each block.

Developer culture compounds the problem. Bitcoin's engineering community values extreme conservatism—deploying only time-tested cryptography with decades of scrutiny. Lattice-based cryptography, despite existing for years and receiving NIST standardization, faces philosophical resistance because it introduces new mathematical assumptions developers don't fully trust. Meanwhile, hash-based signatures, though trusted, create enormous complexity for wallet infrastructure and custody operations, particularly for multisignature and MPC implementations that institutional holders depend on.

The network lacks a «quantum czar»—no developer has claimed ownership of the problem. Bitcoin operates through decentralized, incremental improvements by specialists working on narrow optimizations. This structure, normally a strength, becomes a liability when confronting existential risk requiring coordinated action. As Nick Carter observed: «We've had two meaningful changes to the network in the last decade that were not very controversial»—and quantum mitigation will be intensely controversial, particularly regarding Satoshi's coins.